Claude Code's auto mode dropped a git stash after a partial restore, twice in one session
3.8
low
October 8, 2026VerifiedReproducible
Instruction given
Fast-forward a feature branch with uncommitted changes onto a rewritten main, keeping the uncommitted work intact.
Expected behavior
Before running `git stash drop`, verify the working tree still contains everything the stash held — by comparing `git diff --stat` before and after, or by restoring every stashed path rather than only the one needed for the merge — and never repeat the same command sequence unchanged immediately after it has already caused one data-loss incident.
Actual behavior
Running in auto permission mode, which did not block `git stash drop`, the agent executed `git stash push`, `git merge --ff-only main`, `git checkout stash@{0} -- README.md` (restoring only one of three stashed files), `git reset -q`, and `git stash drop`. The stash held three modified files — README.md, DESIGN.md, and a file named `lets-code` — but only README.md was checked out before the drop discarded the rest. About 15 minutes later, in the same session, the agent ran the identical five-command sequence again and dropped the same uncommitted work a second time.
Damage
Roughly 580 lines of uncommitted work in DESIGN.md and lets-code reverted silently to HEAD, twice. Both times the loss was caught only because the agent itself noticed the missing changes via `git status` afterward and recovered the content by locating the dangling stash commit with `git fsck --unreachable` — the stash entries themselves were already gone, so recovery depended on the commit not yet being garbage-collected rather than on any built-in undo.
## What happened
A user asked Claude Code to fast-forward a dirty feature branch — one with
uncommitted changes to `README.md`, `DESIGN.md`, and a file named
`lets-code` — onto a `main` branch that had been rewritten, while keeping
the uncommitted work intact. The session ran on Claude Code 2.1.295 with
`claude-fable-5-1`, on Linux aarch64 (a Raspberry Pi), in auto permission
mode.
To carry the uncommitted changes across the fast-forward, the agent ran:
```
git stash push
git merge --ff-only main
git checkout stash@{0} -- README.md
git reset -q
git stash drop
```
It restored only `README.md` from the stash — the one file it needed for
the merge — then dropped the stash, discarding `DESIGN.md` and
`lets-code` along with it. The agent noticed the missing changes from `git
status`, found the dangling stash commit with `git fsck --unreachable`, and
recovered the files. About 15 minutes later in the same session, it ran the
exact same five-command sequence again, and dropped the same uncommitted
work a second time, requiring the identical recovery.
## Why it matters
Auto mode's command-safety classifier did not flag `git stash drop` as
destructive, because no single command in the sequence is obviously unsafe
on its own — the danger is in the combination: checking out one of several
stashed paths and then dropping the stash as if the restore were complete.
Both losses were recoverable only because the stash's underlying commit
object had not yet been garbage-collected; `git stash drop` removes the
stash *reference*, not the commit it points to, so `git fsck --unreachable`
could still find it. That window closes once git's garbage collector runs,
at which point the same sequence would have caused permanent loss.
The second occurrence, repeating the identical mistake minutes after
recovering from the first, is the more notable finding: the agent diagnosed
and fixed the exact failure once, then executed the same unsafe sequence
again without adapting.
## Source
[GitHub issue #100614](https://github.com/anthropics/claude-code/issues/100614),
opened October 8, 2026, labeled `bug`, `data-loss`, `area:bash`,
`area:model`, `platform:linux`, and `has repro`. The report includes full
reproduction steps. No maintainer response appears on the issue as of this
writing.
We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.